Of course, that just moves the problem around — now you have to worry about domain hijacking.

And of course one of Shimel’s problems was that they stole both his email and his domain — see his rant about Go Daddy here.
After reading his various postings on this, I am left with two basic questions:

1. What would he (or you) do to avoid future identity theft?
2. What would he (or you) do to improve the chances of recovery from future identity theft?

In “I’m back“, he writes,

Where before I viewed security as a business that I was in, security from here on in will be a much more passionate endeavor for me. In many ways this has made me truly a security person. You will see a much deeper commitment by me in keeping the slime of the world from being successful. I am going to do everything I can to making myself, my family and all of us more secure. Security for me has gone from a business to a way of life.

That’s a lovely sentiment, and I’m sure that many people leave their “Wall of Sheep” experience feeling the same way, but what does it really mean?
After 9/11, the US as a country said much the same thing. And then we entered into a security plan that centers on identity. To stop terrorists. You might be able to stop known terrorists with an identity-based solution, but identity won’t do squat about stopping unknown terrorists, and in fact the ideal story for a terrorist is to go from unknown terrorist to world famous successful terrorist. Identity helps achieve that.
And as Bruce Schneier recently pointed out, an MI5 reports suggests, profiling to identify terrorists isn’t likely to work, at least not with our current understanding of profiling.
I hear a lot of people these days declaring a devotion to “better security”, and “better practices”, but what are those practices?
Shimel himself, pointed out that the biggest problem, the “clowns” in the security circus are the software implementers. He begs us not to blame the security people but the masses of coders who build the vulnerable products.
Consider this in light of Schneier’s comment that security engineering is “programming Satan’s computer” and harder than just creating reliable software on “Murphy’s computer” and way harder than “straight forward” computer programming.
What makes Shimel’s harried programmers “clowns” is that they are just programming generic computers and not either Murphy’s or Satan’s. But is only the cream of the elite are doing it right and the great unwashed masses of programmers are clowns, building in vulnerability, what’s a “security person” going to do?
How do we answer the two questions above?
Just asking.